The SCIM event handler read the client address from r.RemoteAddr only, so when probod runs behind an HTTP load balancer every event row recorded the load balancer's internal IP. Switch to clientip.Extract, which honors the Forwarded / X-Forwarded-For headers already validated by trustedproxy middleware. Signed-off-by: Bryan Frimin <bryan@getprobo.com>